Tabletop Exercises That Actually Prepare Your Team

Every organization that has handled a serious incident learns the same lesson: the plan on paper and the response in practice are not the same. Contact lists are out of date. Nobody is sure who can authorize shutting down a system. Legal and communications are brought in too late. Backups take longer to restore than anyone assumed.

Tabletop exercises surface those problems in a safe setting. A facilitator walks participants through a realistic scenario, introducing new information as the situation evolves, and participants talk through what they would do, who they would call and what they would decide. Nothing is touched in the live environment. The goal is to find the gaps before an attacker does.

Set clear objectives

An exercise without objectives becomes an interesting conversation. Decide in advance what you want to test, for example:

• Can we confirm and scope an intrusion within the first hours?
• Do we know who decides to isolate critical systems, and how quickly can they decide?
• Can we meet external reporting requirements, such as the 72-hour DFARS 252.204-7012 reporting window for defense contractors?
• How do we communicate with employees, customers and partners when email may be compromised?
• Can we restore our most critical systems within our recovery objectives?

Choose a realistic scenario

Scenarios work best when participants recognize them as plausible for their organization:

• Ransomware that encrypts servers after data has already been stolen.
• A compromised administrator account used to change cloud configurations.
• An exploited edge device, such as a VPN, used to gain long-term access.
• Business email compromise leading to a fraudulent payment.
• A supplier compromise that affects your systems or data.
• An insider who exfiltrates sensitive program information.

Build the scenario in stages, called injects, that reveal information gradually and force decisions under uncertainty, just as a real incident would. CISA publishes free Tabletop Exercise Packages that organizations can adapt.

Invite the right people

Technical responders are essential, but many of the hardest decisions in an incident are not technical. Include:

• Executive leadership, who authorize business decisions and accept risk.
• Legal and contracts, who understand reporting obligations and contractual requirements.
• Communications, who handle employees, customers, partners and the media.
• Operations and mission owners, who know what can be shut down and for how long.
• Human resources, for insider scenarios.
• Key suppliers and service providers, when their roles matter in the scenario.

Run separate technical exercises for responders and executive exercises for leadership, and occasionally combine them to test the handoffs.

Run the exercise well

• Use an experienced facilitator who keeps the discussion moving, challenges assumptions and keeps the focus on decisions rather than technical detail.
• Make it safe to admit gaps. The purpose is to find weaknesses, not to grade individuals.
• Keep time realistic. Compress hours into minutes, but make participants feel the pressure of decisions made with incomplete information.
• Capture everything. Assign a dedicated note-taker to record decisions, questions, gaps and ideas.

Turn findings into improvements

The exercise is only the beginning. Afterward:

1. Write an after-action report with what worked, what did not, and specific recommendations.
2. Assign owners and deadlines for each improvement, such as updating contact lists, clarifying decision authority or adding logging.
3. Update the incident response plan and playbooks to reflect what you learned.
4. Track improvements to completion, and verify them in the next exercise.

Organizations that exercise regularly, at least annually and after significant changes, build response habits that hold up under real pressure.

Beyond the tabletop

As programs mature, organizations move from discussion-based exercises to functional exercises, in which teams perform actual response tasks, and to purple team exercises, in which defenders respond to real attack techniques executed in a controlled way. Each step tests readiness more realistically.

Frequently asked questions

How long should a tabletop exercise last? Most run between two and four hours. Executive sessions are often shorter.

How often should we exercise? At least annually, and after major changes to systems, leadership or plans.

Do tabletop exercises satisfy compliance requirements? Many frameworks, including NIST SP 800-53 and NIST SP 800-171, call for incident response testing, and tabletop exercises are a common way to meet them.

How CDT can help

CDT designs and facilitates exercises grounded in real attacks. Our incident response team runs tabletop exercises for technical teams and leadership, our cyber training and exercises build hands-on skills on realistic ranges, and our red, blue and purple team engagements test readiness against live attack techniques.